3ffb6387[.]memo-ba1[.]pages[.]dev

The domain 3ffb6387.memo-ba1.pages.dev was identified as a high‑risk brand‑impersonation site targeting Ledger users. Infrastructure analysis shows the domain resolves to IP address 172.66.45.29, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration data indicates the domain is hosted through Cloudflare, Inc., using the authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. The site presented a valid SSL certificate issued by Google Trust Services / WE1, and HTTP headers confirmed the presence of HTTP/3 and HSTS enforcement.

An HTTP request returned a 403 status code, and the page title reported by the scanner was "Ledger Live," aligning with the declared brand target of Ledger and the reported scam type of a crypto‑related fraud. VirusTotal scanned the domain, flagging it with 16 detections out of 93 participating security vendors. Google Safe Browsing classified the URL as social engineering, and the domain appears on a single external blocklist. The site was also blocked by PhishDestroy, and the Gridinsoft trust score was recorded as 0 / 100, reinforcing the malicious assessment.

The domain was created on 02 September 2020 and, as of the report date (24 July 2026), is listed as offline. While the page content beyond the title has not been publicly disclosed, the combination of brand impersonation, a crypto‑scam label, multiple vendor detections, and a low trust score provides strong evidence of malicious intent. Defenders should add the domain and its resolving IP address to blocklists, enforce URL filtering for known Ledger‑related phishing patterns, and monitor for other Cloudflare‑hosted subdomains that employ similar naming conventions. Continuous re‑evaluation of the domain’s status is advised, as threat actors may reactivate the infrastructure under new identifiers.